This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Total XP security malware

35 min read

This thread's last reply is from April 12, 2010, 2:45 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

3. I did not have any problems.
4. My Gmail is working & I am no longer being directed to ad sites when I use a search engine. Everything seems to be working properly. Thank you very much for your help. Is there anything else I need to do? How could I prevent all of this in the future?
double post
Hello

You need to update to SP3 and now is a good time as your computer is looking clean. you can download it here - http://windowsupdate.microsoft.com/ or you can download it from here http://www.microsoft.com/downloads/details.aspx?FamilyId=5B33B5A8-5E76-401F-BE08-1E1555D4F3D4&displaylang=en

I would like you to run this online scan to be sure there is no leftovers

:Kaspersky scan:

    Please go to Kaspersky website and perform an online antivirus scan.

    • Read through the requirements and privacy statement and click on Accept button.
    • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    • When the downloads have finished, click on Settings.
    • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
        Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    • Click on My Computer under Scan.
    • Once the scan is complete, it will display the results. Click on View Scan Report.
    • You will see a list of infected items there. Click on Save Report As....
    • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    • Please post this log in your next reply.


Let me have the log from kaspersky when it is done

gringo
Ok, I downloaded the Service Pack 3.

I am having trouble running Kaspersky. It's giving me the error:

Kaspersky Online Scanner 7.0 download and operation require Java framework version 1.5 or later.

However, when I go to the Java website, it says I have the latest version downloaded.
ok no problem please try this one

Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.
Here is the log from the Eset scan. It said it found 23 infections, but my computer still seems to be running well.

# version=7
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=a5099d61229b6747805c85d458dae733
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-04-10 05:15:12
# local_time=2010-04-10 01:15:12 (-0400, Atlantic Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=5890 16777214 0 2 49528990 49528990 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16777214 0 9 158748 155775025 0 0
# scanned=79489
# found=23
# cleaned=0
# scan_time=6620
C:\Documents and Settings\jessc0125\Shared\electropop.mp3 WMA/TrojanDownloader.GetCodec.C trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\[4]-Submit_2010-04-07_08.48.13.zip multiple threats 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\[4]-Submit_2010-04-08_08.52.19.zip multiple threats 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\MSASCui.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\avG\av.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\avG\ave.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\avG\MSASCui.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\av.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\ave.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\MSASCui.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\vma.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\LocalService\Local Settings\Application Data\ave.exe.vir a variant of Win32/Kryptik.DLI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL.vir Win32/Adware.WBug.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\odupopak.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oweterot.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rifojehu.dll.vir a variant of Win32/Kryptik.CRQ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rodusano.dll.vir a variant of Win32/Kryptik.DNI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\silugihi.dll.vir a variant of Win32/Kryptik.DNI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tovuriro.dll.vir a variant of Win32/Kryptik.CRQ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\zonokiro.dll.vir a variant of Win32/Kryptik.DNI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\av.exe.vir a variant of Win32/Kryptik.DFO trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\ave.exe.vir a variant of Win32/Kryptik.DLI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Win32/Olmarik.VM trojan 00000000000000000000000000000000 I
# version=7
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=a5099d61229b6747805c85d458dae733
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-04-10 04:40:38
# local_time=2010-04-10 12:40:38 (-0400, Atlantic Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=5890 16777214 0 2 49568790 49568790 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16777214 0 9 198548 155814825 0 0
# scanned=79882
# found=23
# cleaned=0
# scan_time=7944
C:\Documents and Settings\jessc0125\Shared\electropop.mp3 WMA/TrojanDownloader.GetCodec.C trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\[4]-Submit_2010-04-07_08.48.13.zip multiple threats 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\[4]-Submit_2010-04-08_08.52.19.zip multiple threats 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\MSASCui.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\avG\av.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\avG\ave.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\avG\MSASCui.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\av.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\ave.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\MSASCui.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\jessc0125\Local Settings\Application Data\Microsoft\Windows Defender\vma.exe.vir a variant of Win32/Kryptik.DKW trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\LocalService\Local Settings\Application Data\ave.exe.vir a variant of Win32/Kryptik.DLI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL.vir Win32/Adware.WBug.A application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\odupopak.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oweterot.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rifojehu.dll.vir a variant of Win32/Kryptik.CRQ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rodusano.dll.vir a variant of Win32/Kryptik.DNI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\silugihi.dll.vir a variant of Win32/Kryptik.DNI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\tovuriro.dll.vir a variant of Win32/Kryptik.CRQ trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\zonokiro.dll.vir a variant of Win32/Kryptik.DNI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\av.exe.vir a variant of Win32/Kryptik.DFO trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\ave.exe.vir a variant of Win32/Kryptik.DLI trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Win32/Olmarik.VM trojan 00000000000000000000000000000000 I
Good afternoon

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

File::
C:\Documents and Settings\jessc0125\Shared\electropop.mp3
SkipFix::


Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Very well done!! This is my general post for when your logs show no more signs of malware ;)- Please let me know if you still are having problems with your computer and what these problems are.

ESET is only reporting backups created during the course of this fix, and items located in C:\System Volume Information\, which is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be resetting/clearing the cache shortly.

The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

:Uninstall ComboFix:

  • push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • please copy and past the following into the box ComboFix /Uninstall and click OK.
  • Note the space between the X and the /Uninstall, it needs to be there.


:DeFogger:

    To re-enable your Emulation drivers, double click DeFogger to run the tool.
    • The application window will appear
    • Click the Re-enable button to re-enable your CD Emulation drivers
    • Click Yes to continue
    • A 'Finished!' message will appear
    • Click OK
    • DeFogger will now ask to reboot the machine - click OK

    IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

    Your Emulation drivers are now re-enabled.


:Make your Internet Explorer more secure:

    please visit this page that gives instructions to do this
    http://surfthenetsafely.com/ieseczone8.htm


:Turn On Automatic Updates:

    Turn On Automatic Updates
    1. Click Start, click Run, type sysdm.cpl, and then press ENTER.
    2. Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them

    If you click this setting, click to select the day and time for scheduled updates to occur. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. After you set this option, Windows recognizes when you are online and uses your Internet connection to find updates on the Windows Update Web site or on the Microsoft Update Web site that apply to your computer. Updates are downloaded automatically in the background, and you are not notified or interrupted during this process. An icon appears in the notification area of your taskbar when the updates are being downloaded. You can point to the icon to view the download status. To pause or to resume the download, right-click the icon, and then click Pause or Resume. When the download is completed, another message appears in the notification area so that you can review the updates that are scheduled for installation. If you choose not to install at that time, Windows starts the installation on your set schedule.

    or visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


:antispyware programs:
    you have a couple of good antispyware programs on this computer but you still can try some of these others to see if you like them also

    I would reccomend the download and installation of some or all of the following programs (all free), and the updating of them regularly:
    • WinPatrol As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.

    • Malwarebytes' Anti-Malware- Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
      totally free but for real-time protection you will have to pay a small one-time fee.
    • Spyware Blaster - By altering your registry, this program stops harmful sites from installing things like ActiveX Controls on your machines.


please read this great article by miekiemoes How to prevent Malware:
and
this great article by Tony Klein So How Did I Get Infected In First Place

Now you have followed my advice - it's time to lodge a complaint against what you have suffered.........

Malware Complaints
If you were infected .... Stand Up and be Counted.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.

Gringo
Ok, I followed all your instructions. Things are running very smoothly now, thank you for your help, you can close the thread now.
As this topic is resolved,